In one of the biggest surprises to hit the Bitcoin world, blockchain investigators have uncovered a massive bitcoin theft that went completely undetected for almost five years.
The victim is a little-known but powerful Chinese mining pool called LuBian. The heist? 127,426 bitcoin — $3.5 billion at the time and $14.5 billion now.
This is now the largest digital asset heist in history, bigger than Mt. Gox, Bitfinex and the recent $1.5 billion Bybit hack from 2025.
The heist occurred on December 28, 2020 but went unnoticed until August 2025, when blockchain analytics firm Arkham Intelligence revealed it.
At the time of the breach, LuBian was among the top 10 bitcoin mining pools, controlling 6% of the global Bitcoin hashrate. It reportedly had operations in China and Iran.
Arkham says on the day of the attack, the hackers stole over 90% of LuBian’s bitcoin in one sweep. Two days later $6 million in BTC and USDT was stolen from a LuBian address using the Bitcoin Omni Layer protocol.
What’s even more astonishing is that neither LuBian nor the attackers ever publicly acknowledged the theft. Arkham team says the incident was buried for years until they connected the dots through forensic blockchain analysis.
According to Arkham, after realizing the scale of the theft, LuBian tried to recover its assets.
The mining pool sent 1,516 tiny Bitcoin transactions to the hacker’s wallet addresses. These transactions contained OP_RETURN messages, a feature in the Bitcoin protocol that allows users to embed text in blockchain transactions.
The messages, which cost LuBian 1.4 BTC to send, talked about the return of assets and a possible reward.
The report suggests that the OP_RETURN messages were likely from the real LuBian operators, not a copycat, citing correct pattern, cost and timing.
But how did a large and experienced mining operation get hacked so easily?
It’s believed the issue was with LuBian’s faulty private key generation. Arkham says LuBian used an algorithm that was brute forceable, where hackers tried every combination until they guessed the private key.
This one vulnerability allowed the attackers to access and move most of LuBian’s bitcoin without much hassle.
After the theft, LuBian managed to recover about 11,886 BTC which was moved into recovery wallets by December 31, 2020. These coins are still untouched and are now worth around $1.35 billion.
The stolen coins sat idle for years until July 2024, when Arkham noticed a large wallet consolidation. This was the first movement of the stolen bitcoin since the attack. Today, the wallet holding the stolen funds is the 13th largest bitcoin wallet in the world.
The hacker is still unknown and there has been no movement of the funds since 2024.
The bitcoin market didn’t show any signs of distress after the revelation. Despite the size of the theft, bitcoin prices remained stable — a sign of the market’s maturity or perhaps its resilience to old wounds reopening.
LuBian is not an isolated incident.
According to Hacken, $3.1 billion in digital assets were stolen in the first half of 2025 alone — $1.83 billion of which was from so-called “access control attacks” where hackers exploit weaknesses in admin credentials or infrastructure.
These numbers show the extent of the LuBian hack and how big it was compared to other similar incidents.
